CVE-2026-7415

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard	Exploit Third Party Advisory
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001	Third Party Advisory
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:yarbo:lawn_mower_firmware:2.3.9:*:*:*:*:*:*:*

cpe:2.3:h:yarbo:lawn_mower:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:yarbo:lawn_mower_pro_firmware:2.3.9:*:*:*:*:*:*:*

cpe:2.3:h:yarbo:lawn_mower_pro:-:*:*:*:*:*:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) El broker MQTT incrustado en el firmware de Yarbo v2.3.9 está configurado para permitir conexiones anónimas sin ACLs de lectura o escritura a nivel de tema. Cualquier host en la misma red puede suscribirse a temas de telemetría sensibles o publicar mensajes de control directamente al robot sin autenticación o autorización de ningún tipo.

Information

Published : 2026-05-07 17:15

Updated : 2026-10-26 00:10

NVD link : CVE-2026-7415

Mitre link : CVE-2026-7415

CVE.ORG link : CVE-2026-7415

JSON object : View

Products Affected

yarbo

lawn_mower_pro_firmware
lawn_mower_firmware
lawn_mower
lawn_mower_pro

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-7415", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7415", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-07T17:04:20.271427Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@takeonme.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@takeonme.org", "affectedData": [{"vendor": "Yarbo", "product": "Firmware", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.3.9"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-07T17:15:59.570", "references": [{"url": "https://github.com/Bin4ry/yarbo-nat-in-my-back-yard", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@takeonme.org"}, {"url": "https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001", "tags": ["Third Party Advisory"], "source": "cve@takeonme.org"}, {"url": "https://github.com/Bin4ry/yarbo-nat-in-my-back-yard", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@takeonme.org", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind."}, {"lang": "es", "value": "El broker MQTT incrustado en el firmware de Yarbo v2.3.9 est\u00e1 configurado para permitir conexiones an\u00f3nimas sin ACLs de lectura o escritura a nivel de tema. Cualquier host en la misma red puede suscribirse a temas de telemetr\u00eda sensibles o publicar mensajes de control directamente al robot sin autenticaci\u00f3n o autorizaci\u00f3n de ning\u00fan tipo."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:yarbo:lawn_mower_firmware:2.3.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40676938-F32C-4254-8BB6-51355E2A9B52"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:yarbo:lawn_mower:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "94EEF528-48EF-4892-B74A-B79B79AFC417"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:yarbo:lawn_mower_pro_firmware:2.3.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BF14480-B5C0-4EF9-A9BA-81AD73B7588E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:yarbo:lawn_mower_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "165A0B1F-A9BD-4C58-A4CE-26C4CBCD4C21"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@takeonme.org"}